Start working on keycloak in staging

Signed-off-by: Aurélien Bompard <aurelien@bompard.org>

inventory/group_vars/all

@@ -145,6 +145,8 @@ ipa_server_nodes:
   - ipa01.rdu3.fedoraproject.org
   - ipa02.rdu3.fedoraproject.org
   - ipa03.rdu3.fedoraproject.org
+keycloak_db_hostname: "db-fas01.rdu3.fedoraproject.org"
+keycloak_version: "26.3.5"
 ks_repo: https://infrastructure.fedoraproject.org/repo/rhel/RHEL9-x86_64/
 # defaults for virt installs
 ks_url: https://infrastructure.fedoraproject.org/repo/rhel/ks/kvm-rhel

inventory/group_vars/staging

@@ -20,6 +20,8 @@ ipa_server_nodes:
   - ipa01.stg.rdu3.fedoraproject.org
   - ipa02.stg.rdu3.fedoraproject.org
   - ipa03.stg.rdu3.fedoraproject.org
+keycloak_db_hostname: "db-fas01.stg.rdu3.fedoraproject.org"
+keycloak_version: "26.3.5"
 mirrors_centos_org_cert_file: mirrors.stg.centos.org.cert
 # This is the mirrors.stg.centos.org certs
 mirrors_centos_org_cert_name: mirrors.stg.centos.org

playbooks/openshift-apps/keycloak.yml

@@ -0,0 +1,71 @@
+#
+# Keycloak
+# https://www.keycloak.org/operator/installation#_installing_by_using_kubectl_without_operator_lifecycle_manager
+#
+---
+- name: Setup the database
+  hosts: db-fas01.stg.fedoraproject.org
+  gather_facts: no
+  become: yes
+  become_user: postgres
+  vars_files:
+    - /srv/web/infra/ansible/vars/global.yml
+    - /srv/private/ansible/vars.yml
+    - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
+
+  tasks:
+    - name: Keycloak DB user
+      community.postgresql.postgresql_user:
+        name: keycloak
+        password: "{{ (env == 'production') | ternary(keycloak_prod_db_password, keycloak_stg_db_password) }}"
+    - name: Keycloak database creation
+      community.postgresql.postgresql_db:
+        name: keycloak
+        owner: keycloak
+        encoding: UTF-8
+
+- name: Make the app be real
+  hosts: os_control_stg[0]
+  user: root
+  gather_facts: false
+
+  vars_files:
+    - /srv/web/infra/ansible/vars/global.yml
+    - "/srv/private/ansible/vars.yml"
+    - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml
+
+  roles:
+    - role: openshift/project
+      project_app: keycloak
+      project_description: "OpenID Connect provider"
+      project_appowners:
+        - abompard
+        - kevin
+      tags:
+        - apply-appowners
+
+    - role: openshift/object-remote
+      object_remote_app: keycloak
+      object_remote_url: https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/{{keycloak_version}}/kubernetes/keycloaks.k8s.keycloak.org-v1.yml
+
+    - role: openshift/object-remote
+      object_remote_app: keycloak
+      object_remote_url: https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/{{keycloak_version}}/kubernetes/keycloakrealmimports.k8s.keycloak.org-v1.yml
+
+    - role: openshift/object-remote
+      object_remote_app: keycloak
+      object_remote_url: https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/{{keycloak_version}}/kubernetes/kubernetes.yml
+
+    # Routes
+    - role: openshift/route
+      route_app: keycloak
+      route_name: web
+      route_host: "keycloak{{ env_suffix }}.fedoraproject.org"
+      route_serviceport: http
+      route_servicename: keycloak-operator
+    - role: openshift/route
+      route_app: keycloak
+      route_name: web-alt
+      route_host: "keycloak.apps.ocp{{env_suffix}}.fedoraproject.org"
+      route_serviceport: http
+      route_servicename: keycloak-operator

roles/openshift/object-remote/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+object_remote_always_apply: false

roles/openshift/object-remote/tasks/main.yml

@@ -0,0 +1,10 @@
+---
+- name: Download the remote file from {{object_remote_url}}
+  ansible.builtin.get_url:
+    url: "{{object_remote_url}}"
+    dest: /etc/openshift_apps/{{object_remote_app}}/{{object_remote_url|basename}}
+  register: _object_remote_result
+
+- name: Call `oc apply` on the downloaded file ({{object_remote_app}}/{{object_remote_url|basename}})
+  ansible.builtin.shell: oc -n {{object_remote_app}} apply --validate=strict -f /etc/openshift_apps/{{object_remote_app}}/{{object_remote_url|basename}}
+  when: _object_remote_result.changed or object_remote_always_apply